ccdeck 3.32.2 → 3.33.1

package/dist/web/index.html

@@ -62,8 +62,8 @@
           stored === "light" || (stored !== "dark" && light) ? "light" : "dark");
       })();
     </script>
-    <script type="module" crossorigin src="/assets/index-hGO2DTdi.js"></script>
-    <link rel="stylesheet" crossorigin href="/assets/index-DKn7nc15.css">
+    <script type="module" crossorigin src="/assets/index-D7ddxIpC.js"></script>
+    <link rel="stylesheet" crossorigin href="/assets/index-BIANlQ9A.css">
   </head>
   <body>
     <div id="root"></div>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ccdeck",
-  "version": "3.32.2",
+  "version": "3.33.1",
   "description": "Live dashboard for Claude Code and Codex — which agent is waiting on you, tool calls, token spend and every Claude Code subagent on one calm canvas. Run it with npx ccdeck.",
   "type": "module",
   "bin": {

package/release-notes.json

@@ -57,7 +57,42 @@
     "3.29.4",
     "3.29.6",
     "3.29.7",
-    "3.29.9"
+    "3.29.9",
+    "3.33.1"
+  ],
+  "3.33.0": [
+    {
+      "title": "🪝 Hooks you add in Claude Code are no longer removed",
+      "body": "Claude Code's hook editor often files a new hook into the same group as the deck's own. Starting the deck, or uninstalling it, then removed the whole group, and your hook went with it without a word. The deck now takes out only its own command and leaves yours where it was, and the same goes for the old finish-sound hook. `ccdeck --uninstall` also stops the decks that are running, so an update in the background cannot put the hooks back."
+    },
+    {
+      "title": "🧵 Resumed Codex sessions show up again",
+      "body": "A Codex session picked up with `codex resume`, or one that ran for days, could go dark on the canvas and drop out of the 5-hour and 7-day usage, because the deck only looked in the two newest day folders. It now follows those sessions and counts their tokens. Two Codex sessions in the same folder get different id suffixes, and a `bash -lc` call shows the command it runs."
+    },
+    {
+      "title": "🤝 A deck paired by the accept switch brings in less",
+      "body": "A deck that paired through the automatic accept switch, and not through an invite, now brings in only the logins you have ticked on this deck, and nothing from it is ticked for sharing onward. Its dialog says \"paired automatically — pair by invite to take it\". Pairing by invite works as before. A typed address is no longer dropped after one failed round, and the sync port stays the same after a rename."
+    },
+    {
+      "title": "⬆️ Desktop updates install when you expect them",
+      "body": "On Windows and Linux a downloaded update now installs when you quit. On a Mac, Quit installs it and the app stays closed. The Linux .deb needs an administrator password to install, so it no longer does that by itself: it waits for \"Restart to update\" and says a password is coming. \"Start at login\" now works on Linux, and \"Restart ccdeck\" stops a deck that has hung."
+    },
+    {
+      "title": "🕵️ Browser Watch waits before it acts, and quits only its own browser",
+      "body": "A program's visit is now logged and reacted to once its quiet window has closed, about 16 minutes after it, and not on the first poll, so a visit that is withdrawn no longer quits the browser. On Linux the quit reaction ends only the browser that holds the watched profile; other Chrome channels and headless browsers keep running. When it cannot tell which process that is, it does nothing and says so, which includes a Flatpak Brave."
+    },
+    {
+      "title": "🧮 Figures that were off are right",
+      "body": "Spend by labelled and workflow subagents counts toward a session's tokens and cost. The Projects report prices 1-hour cache writes the way ccusage does, so its dollars match the Usage panel. After a restart the deck rebuilds its whole event history, where it used to rebuild about a third. On Linux the process list shows what each process is using now, not its lifetime average. A count near a boundary reads \"1.00M\", and a full quota window says \"used up\"."
+    },
+    {
+      "title": "🔑 The Usage panel's reads answer the deck's own page only",
+      "body": "The routes behind the Usage panel (/api/quota, /api/ccusage, /api/codex-usage, /api/codex-quota and /api/cswap-auto) now answer the deck's own page, or a client that sends the deck's token. A script that read them with a plain request gets 401 from this version on. The hook, the desktop app and the `ccdeck` command are not affected."
+    },
+    {
+      "title": "🛠️ Smaller fixes you may notice",
+      "body": "With the canvas paused, an update no longer restarts the server while an agent is working: it waits until no turn is open. `ccdeck --stop -p4317` stops that one deck. A deck started at login can update itself on Homebrew and nvm setups. Dialogs keep keyboard focus after a button goes away, screen readers hear pairing requests by deck name and the machine panel's readings, dim text is readable in both themes, Windows High Contrast shows what is selected, and below 640px the detail panel opens over the canvas."
+    }
   ],
   "3.32.2": [
     {

package/src/server/account-projects.mjs

@@ -113,10 +113,19 @@ export function localDay(ts) {
   return `${y}-${m}-${day}`;
 }
 
-/** The earliest day a window of `days` includes, counting today as day 1. */
+/** The earliest day a window of `days` includes, counting today as day 1.
+ *
+ *  Counted in calendar days (#1775). `now − (days − 1) × 24h` read the wrong
+ *  date for an hour of each day when the span held a clock change, since one of
+ *  its days is 23 or 25 hours long: a 7-day window opened just after midnight
+ *  in the week after spring-forward covered eight. Today's date is read off the
+ *  local clock and the step back is taken in UTC, where every day is 24 hours —
+ *  presetSince's rule in usage-range.ts, which the page asks ccusage with, so
+ *  the tally and its calibration cover the same days. */
 export function windowCutoff(days, now = Date.now()) {
   if (!days || days <= 0) return null;
-  return localDay(now - (days - 1) * 86_400_000);
+  const d = new Date(now);
+  return new Date(Date.UTC(d.getFullYear(), d.getMonth(), d.getDate() - (days - 1))).toISOString().slice(0, 10);
 }
 
 /** CC encodes a cwd `/Users/x/y` as the folder `-Users-x-y`. The reverse is

package/src/server/args.mjs

@@ -183,9 +183,16 @@ export function parseArgs(args) {
     // on the machine. The `=` form is the commonest CLI convention there is,
     // and this module's own header names this class of mistake as its reason
     // for existing: "`ccdeck --prot 4500` booted on 4317 and said nothing."
+    //
+    // AND `-p4317`, `-p=4317`, the short option with its value attached, which
+    // is the same fail-open by another spelling (#1780): it went to `unknown`
+    // too, and `ccdeck --stop -p4317` ended every deck. Read as `-p` with that
+    // value — `-p=` included, which is a missing value exactly as `--port=` is.
+    const short = /^-p=?/.exec(argv[i]);
+    const attached = short !== null && argv[i] !== "-p";
     const eq = argv[i].startsWith("--") ? argv[i].indexOf("=") : -1;
-    const a = eq > 2 ? argv[i].slice(0, eq) : argv[i];
-    const joined = eq > 2 ? argv[i].slice(eq + 1) : undefined;
+    const a = attached ? "-p" : eq > 2 ? argv[i].slice(0, eq) : argv[i];
+    const joined = attached ? argv[i].slice(short[0].length) : eq > 2 ? argv[i].slice(eq + 1) : undefined;
     // The value of the flag just matched, or `undefined` when there is nothing
     // usable there. Closes over `i` so it can decline to advance it: not
     // consuming is what hands the token back to the loop.
@@ -224,6 +231,9 @@ export function parseArgs(args) {
     else if (a === "--install") out.install = true;
     else if (a === "--install-service") out.installService = true;
     else if (a === "--uninstall-service") out.uninstallService = true;
+    // What the login item's job starts the deck with, and nothing a person is
+    // expected to type: a start at login leaves a running deck alone (#1778).
+    else if (a === "--at-login") out.atLogin = true;
     else if (a === "--uninstall") out.uninstall = true;
     else if (a === "--purge") out.purge = true;
     else if (a === "--workspace") set("workspace", "a path");

package/src/server/auto-update.mjs

@@ -45,6 +45,19 @@ export const AWAY_TICK_MS = 60_000;
  *  deck left alone overnight would otherwise do that once a minute. */
 export const AWAY_RECHECK_MS = 5 * 60_000;
 
+/**
+ * Whether the hook stream says nothing is running: no turn open, and none heard
+ * from for the whole quiet window (activity.mjs). The server's half of "idle",
+ * shared by the away-update below and by the page's automatic restart, which
+ * asks for it on /api/restart as `whenIdle` (lifecycle.mjs). The page cannot
+ * answer this alone: a paused canvas holds every event for the resume, so its
+ * graph shows nothing running while a turn is (#1764). The server is never
+ * paused.
+ */
+export function turnsQuiet({ busy, quietMs, quietNeedMs = AWAY_QUIET_MS }) {
+  return !busy && quietMs >= quietNeedMs;
+}
+
 /**
  * Whether the deck may consider updating itself right now. Every input is
  * already in memory, so this runs every tick at no cost.
@@ -54,7 +67,7 @@ export function awayGate({
   graceMs = AWAY_BOOT_GRACE_MS, quietNeedMs = AWAY_QUIET_MS,
 }) {
   return enabled === true && supervised === true && !restarting
-    && sinceBootMs >= graceMs && !looking && !busy && quietMs >= quietNeedMs;
+    && sinceBootMs >= graceMs && !looking && turnsQuiet({ busy, quietMs, quietNeedMs });
 }
 
 /**

package/src/server/best-of-nostalgia.mjs

@@ -26,7 +26,8 @@ function currentLiveVideo(html) {
 
 export async function fetchBestOfNostalgia({ fetchImpl } = {}) {
   const now = Date.now();
-  if (cache && now - cacheAt < cacheTtl) return cache;
+  // The stamp, not the value: a miss is remembered too, as null.
+  if (cacheAt && now - cacheAt < cacheTtl) return cache;
   if (inflight) return inflight;
   const get = fetchImpl ?? fetch;
   inflight = (async () => {

package/src/server/block-notify.mjs

@@ -133,10 +133,20 @@ export function turnBody(raw) {
     ? raw.last_assistant_message.replace(/\s+/g, " ").trim()
     : "";
   if (!said) return "Finished its turn";
-  const chars = [...said];
-  return chars.length > TURN_BODY_MAX ? `${chars.slice(0, TURN_BODY_MAX - 1).join("").trimEnd()}…` : said;
+  return cut(said, TURN_BODY_MAX);
 }
 
+/** `text` in at most `max` characters, on a whole one, with an ellipsis when
+ *  something was cut. */
+function cut(text, max) {
+  const chars = [...text];
+  return chars.length > max ? `${chars.slice(0, max - 1).join("").trimEnd()}…` : text;
+}
+
+/** Longest session name in a title. A directory's last segment is a word or
+ *  two; this is only ever reached by a `cwd` nobody would type. */
+export const WHO_MAX = 60;
+
 /**
  * What to put on the desktop.
  *
@@ -156,16 +166,55 @@ export function turnBody(raw) {
 /** Which session a notification is about, in the words the user has for it:
  *  the working directory's last segment, else a short session id. */
 export function whoOf(raw) {
-  const cwd = typeof raw?.cwd === "string" && raw.cwd ? basename(raw.cwd) : "";
+  const cwd = typeof raw?.cwd === "string" && raw.cwd ? cut(basename(raw.cwd), WHO_MAX) : "";
   return cwd || (typeof raw?.session_id === "string" ? raw.session_id.slice(0, 8) : "a session");
 }
 
+// Both strings are cut before they leave, and the body of a Notification with
+// them: `cwd` and `message` arrive in the body of `POST /api/event`, whose
+// caller need present nothing, and each ends up in an OS helper's argv.
 export function blockNotice(raw, product) {
   const who = whoOf(raw);
   if (raw.hook_event_name === "Stop") return { title: `${who} — ${product}`, body: turnBody(raw) };
   const fallback = raw.notification_type === "idle_prompt" ? "Waiting for your input" : "Needs your permission";
   const said = typeof raw.message === "string" && raw.message ? raw.message : fallback;
-  return { title: `${who} — ${product}`, body: said };
+  return { title: `${who} — ${product}`, body: cut(said, TURN_BODY_MAX) };
+}
+
+/**
+ * How many notifications may go out in any BURST_MS, across every session.
+ *
+ * The memo below is per session, which is what lets two agents blocking at
+ * once both be heard — and it is why it bounded nothing across sessions. The
+ * route that feeds this, `POST /api/event`, is in OPEN_MUTATIONS, so a local
+ * caller holding no credential that sent a fresh `session_id` with every post
+ * never met a cooldown at all: with notifications on and no tab open, 1,000
+ * posts were 1,000 notifications under the deck's name, and with no desktop app
+ * connected each was its own osascript, powershell.exe or notify-send. A few a
+ * minute is already more than anybody reads off a tray.
+ *
+ * Nothing past the cap is dropped silently, which is the failure `keeps
+ * sessions apart` pins for the memo: what is held back is counted, and said
+ * once, as that count, when the window reopens — see `heldNotice`.
+ */
+export const BURST_MAX = 3;
+export const BURST_MS = 60 * 1000;
+
+/** The session name the held-back notice goes under, for the desktop app's
+ *  title as `whoOf` is for everything else. */
+export const HELD_WHO = "More sessions";
+
+/** The one notification that stands for `count` held back by the cap. */
+export function heldNotice(count, product) {
+  const whom = count === 1 ? "session needs" : "sessions need";
+  return { title: `${HELD_WHO} — ${product}`, body: `${count} more ${whom} you` };
+}
+
+/** A timer that never holds the process open: nothing here is worth waiting
+ *  for on the way out. */
+function laterUnref(fn, ms) {
+  const t = setTimeout(fn, ms);
+  t.unref?.();
 }
 
 /**
@@ -207,13 +256,64 @@ export function shouldNotify(raw, { clients, replay, lastAt, now }) {
  * and a mute that only takes effect after a restart is not a mute. So it may be
  * a function, asked per event; two events in the same second disagreeing is the
  * correct behaviour when somebody pressed the switch between them.
+ *
+ * `pages` and `later` are for the held-back notice, which is said from a timer
+ * rather than from an event: `pages` answers what `clients` answers for
+ * `consider`, at the moment the window reopens, and `later` is that timer —
+ * injected, like the clock, so the suite can reopen the window by hand.
  */
-export function createBlockNotifier({ notify, product, now = Date.now, enabled = true, onError }) {
+export function createBlockNotifier({ notify, product, now = Date.now, enabled = true, onError, pages = () => 0, later = laterUnref }) {
   const isEnabled = typeof enabled === "function" ? enabled : () => enabled;
   /** memo key (see `memoKeys`) → when it was last announced. Bounded by pruning on read: a
    *  long-lived server sees many sessions and this must not become a second
    *  ring nobody empties. */
   const seen = new Map();
+  /** When each notification still inside the window went out, oldest first:
+   *  never more than BURST_MAX of them. */
+  const sent = [];
+  /** How many the cap has held back since the window filled — a count, so a
+   *  burst costs a number and not a list — and whether a timer will say so. */
+  let held = 0;
+  let waiting = false;
+
+  const hasRoom = at => {
+    while (sent.length > 0 && at - sent[0] >= BURST_MS) sent.shift();
+    return sent.length < BURST_MAX;
+  };
+
+  const raise = (at, title, body, meta) => {
+    sent.push(at);
+    // Fire-and-forget, and the catch is not decoration. `notify` shells out —
+    // osascript, PowerShell, notify-send — and on a Linux box with no
+    // notification daemon the last of those simply is not there. A rejected
+    // promise from a notification must never take down the ingest path that
+    // every hook event in the process goes through.
+    Promise.resolve(notify(title, body, meta)).catch(err => onError?.(err));
+  };
+
+  // The window reopens when the oldest notification in it leaves.
+  const waitForRoom = at => {
+    if (waiting) return;
+    waiting = true;
+    later(sayHeld, Math.max(0, sent[0] + BURST_MS - at));
+  };
+
+  // Once, for everything the cap held back. Not at all if the switch has been
+  // turned off since, or a page has opened since: the page draws every one of
+  // them, which is the rule `shouldNotify` keeps for a single event.
+  function sayHeld() {
+    waiting = false;
+    const count = held;
+    held = 0;
+    if (count === 0 || !isEnabled() || pages() > 0) return;
+    const at = now();
+    if (!hasRoom(at)) {
+      held = count;
+      return waitForRoom(at);
+    }
+    const { title, body } = heldNotice(count, product);
+    raise(at, title, body, { chime: "needs-input", who: HELD_WHO });
+  }
 
   return {
     /** Returns what it did, for the tests and for nothing else. */
@@ -224,18 +324,21 @@ export function createBlockNotifier({ notify, product, now = Date.now, enabled =
       const said = [own, ...also].map(k => seen.get(k)).filter(t => t != null);
       const lastAt = said.length ? Math.max(...said) : undefined;
       if (!shouldNotify(raw, { clients, replay, lastAt, now: at })) return "skipped";
+      // Remembered as said even when the cap holds it back: the held-back
+      // notice speaks for it, and a repeat inside the cooldown is not a second
+      // session to count.
       seen.set(own, at);
       for (const [key, when] of seen) if (at - when > QUIET_MS) seen.delete(key);
+      if (!hasRoom(at)) {
+        held += 1;
+        waitForRoom(at);
+        return "held";
+      }
       const { title, body } = blockNotice(raw, product);
-      // Fire-and-forget, and the catch is not decoration. `notify` shells out —
-      // osascript, PowerShell, notify-send — and on a Linux box with no
-      // notification daemon the last of those simply is not there. A rejected
-      // promise from a notification must never take down the ingest path that
-      // every hook event in the process goes through.
       // `who` alone as well: the desktop app shows its own name above every
       // notification, so the "— ccdeck" the title carries for osascript's sake
       // would be said twice there.
-      Promise.resolve(notify(title, body, { chime: chimeOf(raw), who: whoOf(raw) })).catch(err => onError?.(err));
+      raise(at, title, body, { chime: chimeOf(raw), who: whoOf(raw) });
       return "notified";
     },
   };

package/src/server/browser-history.mjs

@@ -64,7 +64,7 @@
 // falls back to the file's mtime — "something navigated at 09:06, no URL" is a
 // weaker signal than a list of URLs and it is a great deal better than a blank
 // panel and a crash.
-import { chmod, copyFile, mkdir, mkdtemp, rm } from "node:fs/promises";
+import { chmod, copyFile, mkdir, mkdtemp, readdir, rm, stat } from "node:fs/promises";
 import { createRequire } from "node:module";
 import { join } from "node:path";
 import { randomUUID } from "node:crypto";
@@ -344,6 +344,66 @@ let copySeq = 0;
 export const stagingRoot = (home = claudeConfigDir()) =>
   join(home, "agent-dag", "browser-watch", "staging");
 
+/**
+ * How long a staging folder has to have sat untouched before a sweep may take
+ * it. A read holds its folder for the copy, the query and the delete — well
+ * under a second here, and the sqlite3 fallback is cut off at fifteen — so a
+ * folder a minute old belongs to a read that is not coming back. Sibling decks
+ * share the root, which is why a sweep goes by age rather than by whose it is.
+ */
+export const STAGING_STALE_MS = 60_000;
+
+/**
+ * The staging folders this process made and could not delete, retried at the
+ * start of its next read (#1753). Its own reads are over by then, so these need
+ * no age; the rest of the root waits for STAGING_STALE_MS.
+ */
+const _undeleted = new Set();
+
+/**
+ * Remove every staging folder under `dir` that no read is still using.
+ *
+ * WHAT WAS LEFT BEHIND (#1753). `discard` swallows a delete that fails, a deck
+ * that exits mid-read never reaches it, and every read makes a folder of its
+ * own and never looks at the others — so a copy that escaped once was there
+ * for good: a full, unencrypted browsing history, 21 MB here, per escape. The
+ * boot sweep in deck-home.mjs could not reach one either: it does not recurse,
+ * and these are neither `.tmp` nor `.migrating`.
+ *
+ * Run at the start of every read, on the folder it is about to copy into, and
+ * by bin/deck.js at boot, on the root. Only `history-*` names, which are what
+ * readVisitsSince makes — the root is the Browser Watch directory's own
+ * subfolder, so nothing else should be there, and nothing else is touched.
+ * Age is the newest mtime of the folder and what is in it, since a copy still
+ * being written moves its file's mtime and not the folder's.
+ */
+export async function sweepStaging(dir = stagingRoot(), { now = Date.now(), deps = {} } = {}) {
+  const list = deps.readdir ?? readdir;
+  const look = deps.stat ?? stat;
+  const remove = deps.rm ?? rm;
+  let names;
+  try { names = await list(dir); } catch { return 0; }
+  let removed = 0;
+  for (const name of names) {
+    if (!String(name).startsWith("history-")) continue;
+    const path = join(dir, name);
+    let newest;
+    try {
+      const st = await look(path);
+      newest = st.mtimeMs;
+      if (st.isDirectory()) {
+        for (const inner of await list(path)) newest = Math.max(newest, (await look(join(path, inner))).mtimeMs);
+      }
+    } catch {
+      // Gone already, or unreadable: either way not this sweep's to take.
+      continue;
+    }
+    if (now - newest < STAGING_STALE_MS) continue;
+    if (await discard(remove, path)) removed += 1;
+  }
+  return removed;
+}
+
 /**
  * Every navigation newer than `sinceChromeTime`.
  *
@@ -390,6 +450,12 @@ export async function readVisitsSince(historyPath, sinceChromeTime, opts = {}) {
     importSqlite = loadSqlite,
   } = deps;
 
+  // What an earlier read left behind, before this one adds a copy (#1753): its
+  // own undeletable folders first, then anything in the root old enough to
+  // belong to a read that is not coming back.
+  for (const left of _undeleted) if (await discard(remove, left)) _undeleted.delete(left);
+  await sweepStaging(copyDir, { deps: { rm: remove, readdir: deps.readdir, stat: deps.stat } });
+
   const floor = chromeFloor(sinceChromeTime);
   // What comes back when there is nothing to advance to. The input verbatim
   // where it was usable, so a caller that stores it sees no change at all; the
@@ -463,7 +529,7 @@ export async function readVisitsSince(historyPath, sinceChromeTime, opts = {}) {
     // The browser is not installed, the profile moved, the disk is full. All of
     // them are "no rows this poll", none of them is a reason to stop polling.
     await discard(remove, copyPath);
-    await discard(remove, stage);
+    await discardStage(remove, stage);
     return { rows: [], watermark: unchanged, total: null, degraded: true, reason: `copy-failed: ${why(err)}` };
   }
 
@@ -482,7 +548,7 @@ export async function readVisitsSince(historyPath, sinceChromeTime, opts = {}) {
     // makes one per call, so a poll that removed only the file would leave an
     // empty directory behind every ten seconds for as long as the deck is up.
     await discard(remove, copyPath);
-    await discard(remove, stage);
+    await discardStage(remove, stage);
   }
 
   const rows = [];
@@ -518,16 +584,27 @@ export async function readVisitsSince(historyPath, sinceChromeTime, opts = {}) {
  * `recursive` because this is handed BOTH the copy and the `mkdtemp` directory
  * it sits in, and `rm` refuses a directory without it (ERR_FS_EISDIR) even with
  * `force`. On a plain file it changes nothing.
+ *
+ * Says whether the path is gone, for the callers that keep track (#1753).
  */
 async function discard(remove, path) {
-  if (!path) return;
+  if (!path) return true;
   try {
     await remove(path, { force: true, recursive: true, maxRetries: 5, retryDelay: 20 });
+    return true;
   } catch {
     // The OS still has it. It is one file, or one directory holding one file.
+    return false;
   }
 }
 
+/** Delete a read's staging folder, and remember it for the next read if the
+ *  OS would not let go of it yet: a poll still does not fail over it, and the
+ *  copy inside no longer outlives the process that made it (#1753). */
+async function discardStage(remove, stage) {
+  if (!(await discard(remove, stage))) _undeleted.add(stage);
+}
+
 /**
  * The in-process read.
  *

package/src/server/browser-presence.mjs

@@ -26,7 +26,9 @@
 // this platform). There is deliberately no state that means "definitely not
 // connected", because nothing here can establish that.
 import { existsSync } from "node:fs";
-import { basename } from "node:path";
+import { readFile, readlink } from "node:fs/promises";
+import { hostname } from "node:os";
+import { basename, posix } from "node:path";
 import { browserRoots, hasExtension, profileDirs } from "./browser-profiles.mjs";
 import { run } from "./exec.mjs";
 
@@ -158,6 +160,81 @@ const WIN_INSTALL_DIR = {
 export const installMarker = (key, platform = process.platform) =>
   platform === "win32" ? (WIN_INSTALL_DIR[key] ?? null) : null;
 
+/**
+ * The process holding a Chromium user-data root, on Linux, or why none can be
+ * named.
+ *
+ * -> { pid } | { pid: null, reason: "not_running" | "other_host" | "unverified" }
+ *
+ * THE BROWSER SAYS WHICH PROCESS OWNS ITS PROFILE, and nothing else here can
+ * (#1752). Chrome, Chrome Beta and Chrome Canary are all `chrome` to `pgrep -x`
+ * and `pkill -x` — the table above collides three ways on it — and so is every
+ * Playwright or Puppeteer browser, headless or not, each started with a
+ * `--user-data-dir` of its own. A name answers for all of them at once. What
+ * answers for one is the lock every Chromium browser keeps in its user-data
+ * root while it runs: `SingletonLock`, a symlink to `<host>-<pid>` naming the
+ * one process holding that root. Only one can, because the lock is how the
+ * browser refuses to open a profile twice.
+ *
+ * THE LOCK IS CHECKED BEFORE IT IS BELIEVED. It outlives a browser that
+ * crashed, and the pid it names can come round again as anything, so the
+ * process is looked up in /proc and the answer is a pid only when:
+ *
+ *   * the lock was taken on this host — a home on a network share can hold
+ *     another machine's lock, and its pid means nothing here;
+ *   * the process is named as one of the browsers in the Linux table;
+ *   * it is a browser's main process: no `--type=`, which every renderer, GPU
+ *     and utility process carries;
+ *   * it is not headless, which is what an automation run looks like;
+ *   * and a `--user-data-dir` it was started with names this root. None means
+ *     the channel's default root, which is the one the lock is in.
+ *
+ * Anything else is `unverified`, and the caller does nothing with it: a
+ * process this cannot attribute is one it must not signal. A Flatpak browser
+ * lands there, since its lock carries a pid from its own pid namespace.
+ * `not_running` is no lock, or a lock whose process is gone — which is also
+ * what a system without /proc reads as, and that too does nothing.
+ *
+ * `deps` takes `readlink`, `readFile`, `procRoot` and `hostname`, so every case
+ * of this is checkable without a browser, a /proc or a lock on the machine.
+ */
+export async function rootOwner(root, deps = {}) {
+  const link = deps.readlink ?? readlink;
+  const read = deps.readFile ?? readFile;
+  const proc = deps.procRoot ?? "/proc";
+  let target;
+  try { target = String(await link(posix.join(root, "SingletonLock"))); }
+  catch { return { pid: null, reason: "not_running" }; }
+  // The host may itself contain dashes; the pid is the digits after the last.
+  const m = /^(.*)-(\d+)$/.exec(target);
+  if (!m) return { pid: null, reason: "unverified" };
+  if (m[1] !== (deps.hostname ?? hostname)()) return { pid: null, reason: "other_host" };
+  const pid = Number(m[2]);
+  if (!Number.isSafeInteger(pid) || pid <= 1) return { pid: null, reason: "unverified" };
+
+  let comm, argv;
+  try {
+    comm = String(await read(posix.join(proc, String(pid), "comm"), "utf8")).trim();
+    argv = String(await read(posix.join(proc, String(pid), "cmdline"), "utf8")).split("\0").filter(Boolean);
+  } catch (err) {
+    return { pid: null, reason: err?.code === "ENOENT" ? "not_running" : "unverified" };
+  }
+  if (!LINUX_BROWSER_NAMES.has(comm)) return { pid: null, reason: "unverified" };
+  if (argv.some(a => a.startsWith("--type=") || a === "--headless" || a.startsWith("--headless="))) {
+    return { pid: null, reason: "unverified" };
+  }
+  const flag = argv.find(a => a.startsWith("--user-data-dir="));
+  if (flag !== undefined && posix.resolve(flag.slice("--user-data-dir=".length)) !== posix.resolve(root)) {
+    return { pid: null, reason: "unverified" };
+  }
+  return { pid };
+}
+
+/** Every name the Linux table gives a browser's process. Any of them, not only
+ *  the root's own: the check is that the pid is a browser at all, and the lock
+ *  is what says which one. */
+const LINUX_BROWSER_NAMES = new Set(Object.values(APP_NAME.linux));
+
 /** Every address the relay currently resolves to.
  *
  *  Empty is not an error — a machine with no `dig`, or one where the name is
@@ -190,6 +267,25 @@ export async function isRunning(app, platform = process.platform, deps = {}) {
   return String(out.stderr ?? "").trim() === "" ? false : null;
 }
 
+/**
+ * Whether one browser root's browser is running.
+ *
+ * By name, except where the name is shared (#1752): on Linux, `pgrep -x chrome`
+ * answers yes for Chrome Beta whenever stable Chrome or any Playwright browser
+ * is up. There the answer is whether a process holds the root's own lock —
+ * the same test the quit reaction makes before it signals anything, so the
+ * panel and the reaction cannot disagree about which Chrome is running. A lock
+ * that cannot be checked is "cannot tell", not "no".
+ */
+async function runningHere(root, app, platform, deps) {
+  if (platform === "win32" || platform === "darwin" || sharesProcessName(root.key, platform).length === 0) {
+    return await isRunning(app, platform, deps);
+  }
+  const owner = await rootOwner(root.root, deps);
+  if (owner.pid !== null) return true;
+  return owner.reason === "not_running" ? false : null;
+}
+
 /**
  * What can be said about this browser's connections to the relay.
  *
@@ -254,7 +350,7 @@ export async function browserSurvey({
     const installed = exists(root.root);
     const profiles = installed ? profileDirs(root.root, deps.fs) : [];
     const app = processName(root.key, platform);
-    const running = installed && app ? await isRunning(app, platform, deps) : false;
+    const running = installed && app ? await runningHere(root, app, platform, deps) : false;
     out.push({
       key: root.key,
       name: root.name,